Job Description

Location: Canberra, Australian Capital Territory (ACT) (remote considered)

n

Security Clearance: Baseline Clearance

Threat Detection Engineeringn
n

n
- SIEM use case development and detection content creation

n
- Detection rule development and tuning

n
- SOAR playbook development

n
- STRIDE

n
- MITRE ATT&CK;

n
- Attack path analysis

n
- Detection coverage assessment

n
- Gap analysis

n
- Threat intelligence integration and management

n
- Research into emerging threats

n
- Intelligence sharing across infrastructure and architecture teams

n

Security Operationsn
n

n
- SOC operations

n
- ITIL and Agile environments

n

AI Security (Significant New Requirement)n
n

The RFQ specifically calls for experience in:

n

n
- AI threat modelling

n
- AI-related data leakage monitoring

n
- Adversarial AI activity detection

n
- Security monitoring of AI platforms, services and agents

n

n

A strong candidate would typically have:

n

n
- 5+ years in SOC, Detection Engineering, Threat Hunting, or Cyber Security Operations

n

Hands-on experience with platforms such as:n
n

n
- Microsoft Sentinel

n
- Splunk

n
- QRadar

n
- CrowdStrike

n
- Strong understanding of MITRE ATT&CK;

n
- Experience integrating threat intelligence feeds

n
- Good documentation and stakeholder engagement skills

n

Evaluation Themes to Address in a Submissionn
n

When preparing a candidate response, focus on evidence demonstrating:

n

n
- Development of threat detection use cases and rules.

n
- SIEM/EDR content engineering and tuning.

n
- Threat modelling expertise using STRIDE and ATT&CK.;

n
- Threat intelligence integration and analysis.

n
- Experience supporting incident response activities.

n
- Security monitoring of cloud and on-premises environments.

n




- AI security and emerging threat detection capabilities.

n
- Working within Agile and ITIL environments.

n

Requirementsn

1. Detection Engineering and SIEM Expertise - Demonstrated experience developing detection content across at least two enterprise SIEM platforms (e.g. Splunk, Microsoft Sentinel, QRadar, Elastic).

n

2. Threat Detection and Response Capability - Experience developing and implementing detections across SIEM, SOAR and EDR platforms, including incident response automation and playbook development.

n

3. Threat Modelling and Threat Intelligence - Practical experience conducting threat modelling using recognised methodologies (e.g. STRIDE, PASTA, ATT&CK;) and translating outcomes into detection and monitoring requirements, supported by a strong understanding of the cyber threat intelligence lifecycle.

n

4. AI Security Monitoring - Experience identifying, assessing and developing monitoring controls for AI-related security risks, including enterprise AI platforms such as Microsoft Copilot or Azure AI.

n

5. Cyber Security Operations Experience - Minimum five years' experience in cyber security operations, supported by strong organisational, communication and stakeholder engagement skills.

n

1. Sigma Rule Development - Experience developing or using Sigma detection rules and translating detections between security platforms.

n

2. Advanced AI Security Knowledge - Familiarity with AI security frameworks and guidance, including ASD/ACSC, NIST, MITRE ATLAS and OWASP LLM Top 10. Relevant industry certifications such as GIAC, SANS, CISSP, GCIA, GCIH or equivalent cyber security qualifications.

n

3. EDR Platform Expertise - Experience with enterprise EDR technologies such as CrowdStrike, Microsoft Defender for Endpoint and Carbon Black.

n

4. Automation and Scripting - Proficiency in scripting languages such as Python and Bash to support detection engineering and security automation activities.

#J-18808-Ljbffr

📌 SOC Detection Specialist (Harman)
🏢 Powerdatagroup
📍 Harman